Legal information
Privacy policy (GDPR)
1. The data controller
SUCCES SERVICII INTEGRATE SRL, with its registered office at Bulevardul Chișinău No. 1, Complex Delfinului, 1st Floor, Sector 2, Bucharest, postcode 022141, registered with the Trade Register under no. J2018006844401, CUI (tax identification number) 39359167, EUID ROONRC.J2018006844401 (hereinafter “Succes Grup”, “we” or the “Company”).
Contact details: email [email protected], telephone 0771 430 955.
The Company processes personal data as a controller, in accordance with Regulation (EU) 2016/679 (the “GDPR”), Law No. 190/2018 implementing the GDPR in Romania and, for the storage of information on your device and electronic communications, Law No. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector (which transposes Directive 2002/58/EC, the ePrivacy Directive).
2. What data we process and where it comes from
- Data you submit voluntarily through the contact form — required so that we can reply: name, email address and message; optional: telephone number, the services you are interested in, and an approximate budget. If you used a tool from the Lab and pressed “Send the result to us”, the form also records the name of the tool (the “source” field), and the message contains the result you chose to send us. Any other information (for example the company name or the website address) reaches us only if you write it in the message. We process in the same way the data you give us by email or telephone. The form is not intended for special categories of data — please do not send them to us;
- How form data travels — it is sent to the server over an HTTPS connection, and the server forwards it as an email to [email protected]. It is not stored in any database on the website. After sending, it sits in our mailbox and, for short periods, in the queues and logs of the email servers involved. In addition to the data above, the email we receive contains the IP address the request was sent from and the date/time, for security and to identify abuse;
- Contractual and invoicing data — for clients with whom we conclude contracts: identification details of the company and of its representative, and bank details, in accordance with legal obligations;
- Minimal technical data — standard web server logs (IP address, date/time, page accessed), generated automatically whenever any website is accessed and used exclusively for security and operation;
- Anti-spam protection on the form — to limit abusive submissions, the server keeps, in a temporary file, a pseudonymised value (HMAC) derived from the IP address, together with the submission times from the last hour. The file does not contain the IP address in clear text and is not used for any other purpose; it is deleted by the form at the first later submission after two hours have passed, or by the server’s periodic clean-up of temporary files. In addition, the form contains a hidden field that bots fill in and a timestamp of when the page was loaded, used only to reject automated submissions; they are not retained;
- The Lab tools (calculators, simulators, previews, generators) run entirely in your browser: the values you enter are not sent to us and are not stored on the server. We receive them only if you choose to send the result through the contact form. The assistant on the website searches the website’s public materials locally in your browser and does not send your questions to us or to third parties;
- Preferences in your browser — the visual theme, the language, accessibility options, the currency (in the English version) and, at your request, the UTM link history or the audit progress are saved only in your browser (localStorage / sessionStorage); they do not reach us and are not used for tracking. The full list is in the Cookie Policy;
- Google Maps (Contact page) — it loads only if you open it yourself. At that moment your browser connects to Google, which receives your IP address and technical browser data and may set cookies, as an independent controller, under its privacy policy. Without your action, no Google resource is loaded.
The website does not use cookies, analytics tools, pixels or other advertising tracking tools, and does not load fonts or scripts from third parties — see the Cookie Policy.
3. Purposes and legal bases of processing
| Purpose | Legal basis (Article 6 GDPR) |
|---|---|
| Replying to enquiries received through the form, by email or by telephone, and sending the quotations requested | Steps taken at the request of the data subject prior to entering into a contract — Article 6(1)(b); for messages with no contractual intent, our legitimate interest in replying — Article 6(1)(f) |
| Performance of service contracts | Performance of a contract — Article 6(1)(b) |
| Invoicing, accounting and tax records | Legal obligation — Article 6(1)(c) |
| Security of the website and systems, limiting abusive submissions (anti-spam), server logs | Legitimate interests — Article 6(1)(f) |
| Subsequent commercial communications (only with separate, express consent) | Consent — Article 6(1)(a) and Law No. 506/2004 |
The checkbox in the form. The box in the form (unticked by default, required to submit) confirms that you have read this policy and agree that the data you send will be used to reply to your request. Submitting the form does not subscribe you to any newsletter and does not entitle us to send you commercial communications; for those we would ask for separate consent. For processing based on legitimate interests (Article 6(1)(f)) you may object at any time, as described in section 7.
4. Recipients of the data
The data may be accessed, strictly to the extent necessary, by: the web hosting and email service provider (as processor), the Company’s accountant/tax adviser, and public authorities where required by law. Google (for the map you load at your request) acts as an independent controller. We do not sell or rent personal data to third parties.
5. Transfers outside the EU/EEA
We do not initiate transfers of personal data outside the European Economic Area. The only possible transfer, triggered by an action of yours, is to Google if you load the map; it takes place under Google’s own policy. If one of our service providers were to involve a transfer to a third country, it would take place only with appropriate safeguards under Chapter V of the GDPR (for example standard contractual clauses or an adequacy decision).
6. Retention period
- Quotation correspondence and requests received through the form: a maximum of 2 years from the last contact, then deleted or anonymised; if a contract is concluded, the data is kept as described in the next point;
- Contractual and invoicing data: for the period required by tax and accounting legislation (generally 5–10 years);
- The pseudonymised value used to limit abuse: counted for one hour; the temporary file is deleted at the first later submission after two hours, or by the server’s periodic clean-up;
- Technical server logs: short periods, in line with the hosting provider’s practices;
- Data saved in your browser: stays on your device until you delete it (with the buttons in the tools or from your browser settings), except for the sessionStorage summary, which disappears when you close the tab.
7. Your rights
Under the GDPR, you have the right of access to your data, the right to rectification, the right to erasure (“right to be forgotten”), the right to restriction of processing, the right to data portability, the right to object (including to processing based on legitimate interests), and the right to withdraw your consent at any time where processing is based on it (without affecting the lawfulness of processing carried out before withdrawal). To exercise these rights, write to us at [email protected]; we reply within one month at the latest, and to avoid disclosing data to another person we may ask for reasonable confirmation of your identity.
You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), Bd. General Gheorghe Magheru No. 28–30, Sector 1, Bucharest, postcode 010336, email [email protected] — dataprotection.ro — and to apply to the competent courts. Please write to us first, so that we can try to resolve the matter.
8. Data security
We apply appropriate technical and organisational measures: an encrypted HTTPS connection, security headers and a strict content policy (no external scripts), restricted access to correspondence and data, strong passwords, and keeping the systems we use up to date. In the event of a personal data breach we act in accordance with Articles 33–34 GDPR.
9. Automated decision-making and minors
We do not use exclusively automated decision-making processes and we do not carry out profiling that produces legal effects concerning data subjects. The website and the form are not aimed at children under 16.
10. Updates
This policy may be updated; the version in force, with the date of the last update, is permanently published on this page.